Advanced Windows protection: AppLocker, WDAC, Credential Guard, ASR
You let only approved programs run with application control, protect credentials from being stolen from memory and roll out attack surface reduction rules.
Level 401 · 16 lessons · 18 practice labs
Lessons
Application control
- Why application control: allow lists and block lists
- AppLocker rules: publisher, path, hash
- Starting in audit mode and reading the events
- WDAC policies: creating, merging, signing
- Bypass attempts with legitimate tools and block rules
- Short task: block programs from running out of user profiles
Credential protection
- LSASS protection: RunAsPPL
- Credential Guard and virtualisation-based security
- WDigest, cached credentials and Protected Users
- Short task: confirm LSASS protection is on using the event log
Attack surface
- Attack surface reduction (ASR) rules
- Office macros and files from the internet
- Ransomware protection with controlled folder access
- Disk encryption with BitLocker and recovery keys
- Short task: turn on ASR rules in audit mode and tune the noisiest one
Capstone
- Capstone: protect a privileged access workstation (PAW) end to end
Practice labs
- Watch programs launched from user folders in audit mode: Turn on AppLocker in audit mode, run a program and show in an 8003 event what would be blocked.
- Allow only the signed tool with a publisher rule: Write a publisher rule for an application and show the unsigned copy is blocked while the signed one runs.
- Close the legitimate tool used to get around the block: Show the rules being bypassed with mshta, add a deny rule and prove the retry is stopped.
- Build a WDAC policy from audit records: Build an allow list from audit-mode events, merge it with the base policy and show the business app runs under enforcement.
- Confirm LSASS protection is on: Check the RunAsPPL setting, enable it if needed and show the protection is active in the boot event.
- Stop WDigest storing clear-text passwords: Check the WDigest registry value, switch it off and lower the cached logon count to the policy.
- Find out why Credential Guard is not running: Check the VBS requirements with msinfo32 and logs, complete the missing setting and prove Credential Guard is running.
- Turn on the ASR rule that stops Office spawning child processes: Enable the rule in audit mode, trigger it with the test document and show the event.
- Tune the noisiest ASR rule: Find the rule firing most in audit events, add a narrow exclusion for the legitimate app and switch to block.
- Block macros in documents from the internet: Block internet macros through policy and show a macro does not run in a document with the Mark of the Web.
- Stop a ransomware simulation with controlled folder access: Protect the Documents folder, run the simulation and show the files are unchanged and a block event was raised.
- Back up the BitLocker recovery key to a safe place: Encrypt the drive, back up the recovery key to the directory and show it can be read from there.
- Add a PIN to a disk protected by TPM alone: List the protectors, switch to TPM plus PIN and confirm the PIN is asked for at boot.
- Find which drives are unencrypted: List the encryption status of every volume with manage-bde and PowerShell and report the unencrypted ones.
- Read what the Office macro setting is on this machine: Find the effective macro setting for Word and Excel from the registry and policy results and note whether it comes from policy or a local choice.
- Set up signed macros for an accounting team that depends on them: Apply a policy that allows only macros signed with the organisation’s certificate, sign one macro and show that the unsigned copy is blocked.
- Read the WDAC audit events: List from the code integrity log the files audit mode recorded as would-be-blocked and their publishers.
- Deploy a ready WDAC policy in audit mode: Apply the sample policy in audit mode, run an in-house tool and relate the resulting event to the policy rule.
About this course
You let only approved programs run with application control, protect credentials from being stolen from memory and roll out attack surface reduction rules.
What you will learn
- Application control
- Credential protection
- Attack surface
- Capstone
Prerequisites
You should have practised the topics of the same path up to level 301.
Lab environment
Lessons run in a Kali Linux terminal in the browser and in a practice domain (CORP.LAB) set up separately for every lab. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 401; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.